Detections
Analytics

GEN008710 - The system boot loader must protect passwords using an MD5 or stronger cryptographic hash.

Information

If system boot loader passwords are compromised, users with console access to the system may be able to alter the system boot configuration or boot the system into single user or maintenance mode, which could result in Denial-of-Service or unauthorized privileged access to the system.

Solution

Configure the GRUB bootloader to require a password.

Procedure:

Obtain the location of the active GRUB menu file.
# bootadm list-menu

Create a password hash using GRUB. The location of the GRUB binary may be different based on the specific system.
# /boot/grub/bin/grub
grub> md5crypt
Password: <password>
Encrypted: <password hash>
grub> quit

The encrypted password hash will be returned.

Edit the GRUB menu configuration file, and add a line such as the following, substituting the password hash obtained above:

password --md5 <password hash>

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_10_x86_V2R4_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CAT|II, CCI|CCI-000213, Rule-ID|SV-220125r603266_rule, STIG-ID|GEN008710, STIG-Legacy|SV-42317, STIG-Legacy|V-24624, Vuln-ID|V-220125

Plugin: Unix

Control ID: 14ee45105a16acd4f6e3c340006f2872543d9f8934ffcfff7b8836031547da03